@bongos/core 1.24.76 → 1.24.78

package/scripts/bongos/autobongos-run.js

@@ -265,6 +265,10 @@ const WORKER_ENV_ALLOW = [
   // missing here would be set on the host and silently absent in the worker.
   ...claudeBinEnvNames(),
   'XDG_CONFIG_HOME',
+  // The runner's own config root (task 1005095): its login, heartbeat and run log
+  // sit apart from the builder's own CLI session on the same device, and a worker
+  // that did not inherit this would claim and ship as the wrong session.
+  'BONGOS_CONFIG_ROOT',
   // THE WORKER'S OWN CREDENTIAL, and it has to be here (task 1003907, found by
   // running it). On a desktop, the claude CLI authenticates from the credential
   // store under USERPROFILE/HOME, which are already allowed - so this list looked
@@ -451,12 +455,18 @@ function worktreeName(taskId) {
 // A failure of EITHER read returns the shape that refuses. An unreachable
 // instance and a thrown kill switch are different facts, but they license the
 // same action: do nothing.
+// THIS DEVICE is named on the read (task 1005094): the server folds the device's
+// own Run switch into the answer, so a builder's Stop on this machine arrives as
+// `enabled: false` with nothing for this file to decide. The name is the same
+// os.hostname() the heartbeat reports, which is how the two rows line up.
+const fenceArgs = () => ({ query: { host: os.hostname() } });
+
 async function readFence(deps = {}) {
   const api = deps.api || await (require('./cli-lib').cliClient)();
   let raw = null;
   let graderBypassed = null;
   try {
-    const r = await api.autonomy.getAutonomyFence();
+    const r = await api.autonomy.getAutonomyFence(fenceArgs());
     if (r && r.ok) raw = r.data;
   } catch (_) { /* unreadable → refuses below */ }
   try {
@@ -545,7 +555,9 @@ function queueGatedRow(queueGate, now) {
 async function iteration(opts, deps = {}) {
   const runCmd = deps.run || run;
   const spawnWork = deps.spawnWorker || spawnWorker;
-  const readGauge = deps.gauge || (() => gauge.evaluate());
+  // absentMeansGo: a device with no gauge file at all works until the usage limit
+  // stops it (task 1005095) — see decideCapacity in modules/autonomy/gauge.js.
+  const readGauge = deps.gauge || (() => gauge.evaluate(undefined, { absentMeansGo: true }));
   const pick = deps.pickTask || pickTask;
   const log = deps.record || record;
 
@@ -1005,7 +1017,9 @@ async function pollSignals(deps = {}) {
     if (r) head = r;
   } catch (_) { /* null */ }
   try {
-    const f = await api.autonomy.getAutonomyFence();
+    // Named the same way, so a press of Run on this device moves the stamp the
+    // wait is watching and the runner wakes inside a poll instead of an idle.
+    const f = await api.autonomy.getAutonomyFence(fenceArgs());
     if (f && f.ok) fenceUpdatedAt = f.data.updated_at || null;
   } catch (_) { /* null */ }
   try {
@@ -1227,9 +1241,15 @@ async function forever(opts, deps = {}) {
   // `config_idle:<code>` instead of "waiting", so the hall shows the fix rather
   // than "alive" for ten hours. Any row that is not that refusal ends the stretch.
   let idle = null;
+  // When a resting runner resumes, in epoch seconds (task 1005094): the reset the
+  // last hold named. Sent on every beat that is not about a task, so the device's
+  // Run button can show "Resting until 3:40" for the whole wait, not just for the
+  // one beat that followed the hold. Any row that is not such a hold clears it.
+  let restUntil = null;
   const clock = () => (deps.now ? deps.now() : Date.now());
   const beat = async (rawFields) => {
-    const fields = configIdle.markBeat(rawFields, idle, clock());
+    const resting = restUntil && !(rawFields && rawFields.working_task_id) ? { ...rawFields, hold_until: restUntil } : rawFields;
+    const fields = configIdle.markBeat(resting, idle, clock());
     // The runner state is passed, not defaulted: the file names `disk_head` from
     // it (task 1004406), and an injected state must reach the beat that reports it.
     try { beatFile(Date.now(), deps.state || RUNNER_STATE); } catch (_) { /* a runner that cannot write its file still runs */ }
@@ -1275,6 +1295,7 @@ async function forever(opts, deps = {}) {
       row = await iterate(opts, deps);
       emit(row);
       idle = configIdle.trackIdle(idle, row, clock());
+      restUntil = row.event === 'hold' && Number(row.sleep_until) > 0 ? Number(row.sleep_until) : null;
       // Carry the task id so the hall can tell "quiet because it is building
       // task 1234" from "quiet because it is dead". A worker may hold the loop for
       // ninety minutes, and without this every honest hour of work looks like a

package/scripts/bongos/autonomy-gauge.js

@@ -26,9 +26,14 @@ function gaugePath() {
   catch (_) { return null; }
 }
 
+// null means there is NO file. A file that exists but cannot be read or parsed
+// comes back as the string 'unreadable', which the decision treats as a bad
+// reading (unknown) and never as "this device has no gauge" (task 1005095).
 function loadGauge(p) {
   if (!p) return null;
-  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; }
+  let text;
+  try { text = fs.readFileSync(p, 'utf8'); } catch (e) { return e && e.code === 'ENOENT' ? null : 'unreadable'; }
+  try { return JSON.parse(text); } catch (_) { return 'unreadable'; }
 }
 
 function readConfig() {
@@ -47,9 +52,12 @@ function readConfig() {
   return c;
 }
 
-function evaluate(nowEpochS = Math.floor(Date.now() / 1000)) {
+// `overrides` is merged over the env config. The supervisor passes
+// { absentMeansGo: true } (task 1005095); this CLI passes nothing, so a missing
+// file is still UNKNOWN here.
+function evaluate(nowEpochS = Math.floor(Date.now() / 1000), overrides = {}) {
   const p = gaugePath();
-  return { path: p, decision: decideCapacity({ gauge: loadGauge(p), now: nowEpochS, config: readConfig() }) };
+  return { path: p, decision: decideCapacity({ gauge: loadGauge(p), now: nowEpochS, config: { ...readConfig(), ...overrides } }) };
 }
 
 async function main(argv) {

package/scripts/bongos/cli-lib.js

@@ -333,7 +333,11 @@ function sessionStoreDir() {
   // Directory name deliberately NOT 'sessions': that is a live module key, and ADR 0083
   // §Decision #4 forbids naming one in shared machinery. 'instances' is the truer name anyway —
   // one file per instance is exactly what this holds.
-  return path.join(os.homedir(), '.config', ic.FALLBACK_DIR, 'instances');
+  // Under the config ROOT, which is ~/.config unless BONGOS_CONFIG_ROOT moves it
+  // (task 1005095) — so an Autobongos runner's login is never filed into, or read
+  // out of, the builder's own store. The root is not the brand: the anchor is
+  // still the same fixed dir name for every checkout that shares a root.
+  return path.join(ic.configRoot(), ic.FALLBACK_DIR, 'instances');
 }
 
 // The store's filename for an instance, derived from its api_base host. Returns null when the base

package/scripts/bongos/stranded-rows.js

@@ -30,6 +30,19 @@
 // MERGE commit's body, where GitHub echoes the branch's subject. A subject-only scan
 // misses the one case this file exists for.
 //
+// A SECOND FORM, because the convention moved (task 1005187). Builders, and ship.js's
+// own regeneration commits, now mostly write the task at the START of the subject:
+// `task N - words`, `task N: words`, with an optional conventional prefix in front
+// (`fix: task N - words`, `wip(scope): task N - words`). Measured over the last 400
+// commits on main on 2026-11-10: 140 subjects in that form against 53 lines ending
+// `(task N)`, covering 18 distinct tasks — under the floor of 20 the live-repo test
+// holds, which is how main went red. So both forms count. The new one is read off the
+// SUBJECT only, and only at its start, followed by a dash or a colon: the same
+// "this commit DID task N" statement, and still not "mentions N" (a subject such as
+// "see task N for why", or any body line naming a task, is not counted). A merge
+// commit's subject is GitHub's, so for one of those the first line of its body — the
+// pull request's own title, which GitHub echoes there — is read the same way.
+//
 // MEASURED on this repo before shipping: 877 ids are named as an authoring subject
 // across 4,784 commits, and ZERO of them are open `ready`/`backlog` rows (434 of
 // those). So today's board is clean and the signal is not merely quiet — the same
@@ -66,13 +79,37 @@ const SEP = `${SOH}COMMIT${SOH}`;
 // mentioned N", and the second is the noise that made the supersession half undoable.
 const AUTHORED_RE = /\(task (\d{6,7})\)\s*$/;
 
+// The second convention: the task leads the subject, after an optional conventional
+// prefix, and is followed by a dash or a colon. Read off a TITLE line only (see
+// titleLines) — never off every line, which is where "mentions N" lives.
+const LEADING_RE = /^(?:[a-z]+(?:\([^)]*\))?!?:\s*)?task (\d{6,7})\s*[-:\u2013\u2014]/i;
+const MERGE_SUBJECT_RE = /^Merge pull request #\d+ /;
+
+// The lines of a message that are a TITLE: its subject, and for a GitHub merge commit
+// the first line of the body too, where GitHub echoes the pull request's own title.
+function titleLines(lines) {
+  const at = lines.findIndex((l) => l);
+  if (at === -1) return [];
+  const out = [lines[at]];
+  if (MERGE_SUBJECT_RE.test(lines[at])) {
+    const echoed = lines.slice(at + 1).find((l) => l);
+    if (echoed) out.push(echoed);
+  }
+  return out;
+}
+
 // PURE — every task id a commit message claims to have DONE. Exported so the rule is
 // testable without a repo: a scanner that quietly stops matching reports a clean board,
 // which is indistinguishable from a healthy one.
 function authoredIds(message) {
   const out = new Set();
-  for (const line of String(message || '').split('\n')) {
-    const m = AUTHORED_RE.exec(line.trim());
+  const lines = String(message || '').split('\n').map((l) => l.trim());
+  for (const line of lines) {
+    const m = AUTHORED_RE.exec(line);
+    if (m) out.add(m[1]);
+  }
+  for (const line of titleLines(lines)) {
+    const m = LEADING_RE.exec(line);
     if (m) out.add(m[1]);
   }
   return out;

package/scripts/gds/autobongos-bootstrap.ps1

@@ -0,0 +1,8 @@
+# scripts/gds/autobongos-bootstrap.ps1 -- @bongos-forwarder (task 1004848). Generated by
+# scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+# The real script is scripts/bongos/autobongos-bootstrap.ps1. This forwarder keeps callers that still name
+# the old path working, and warns once so they get repointed. Task 1003706 removes it.
+if (-not $env:BONGOS_FORWARDER_WARNED) { Write-Warning '[bongos] scripts/gds/autobongos-bootstrap.ps1 has moved to scripts/bongos/autobongos-bootstrap.ps1. This old path still works for now, but update whatever called it. The forwarders in scripts/gds/ are removed in a later release.' }
+$env:BONGOS_FORWARDER_WARNED = '1'
+& (Join-Path $PSScriptRoot '..\bongos\autobongos-bootstrap.ps1') @args
+exit $LASTEXITCODE

package/scripts/gds/autobongos-bootstrap.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# scripts/gds/autobongos-bootstrap.sh — @bongos-forwarder (task 1004848). Generated by
+# scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+# The real script is scripts/bongos/autobongos-bootstrap.sh. This forwarder keeps callers that still name
+# the old path working, and warns once so they get repointed. Task 1003706 removes it.
+if [ -z "${BONGOS_FORWARDER_WARNED:-}" ]; then echo "[bongos] scripts/gds/autobongos-bootstrap.sh has moved to scripts/bongos/autobongos-bootstrap.sh. This old path still works for now, but update whatever called it. The forwarders in scripts/gds/ are removed in a later release." >&2; fi
+export BONGOS_FORWARDER_WARNED=1
+exec bash "$(dirname "$0")/../bongos/autobongos-bootstrap.sh" "$@"

package/scripts/gds/autobongos-host.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// scripts/gds/autobongos-host.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/autobongos-host.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'autobongos-host.js');

package/scripts/hall-preview/server.js

@@ -214,6 +214,13 @@ const CANNED_WRITES = [
   ['POST', /^ai-studio\/uploads$/, 'ai-studio__uploads.post'],
   ['POST', /^ai-studio\/requests$/, 'ai-studio__requests.post'],
   ['POST', /^ai-studio\/topup$/, 'ai-studio__topup.post'],
+  // Settings > Your Autobongos runner (task 1005094): a press of Run or Stop, a
+  // setup code for Add a device, and Remove (the login, then the card), so the
+  // Starting face, the setup command and the removal toast render here.
+  ['POST', /^autonomy\/runners\/[^/]+\/run$/, 'autonomy__runners__run.post'],
+  ['POST', /^auth\/runner-code\/issue$/, 'auth__runner-code__issue.post'],
+  ['POST', /^me\/sessions\/revoke$/, 'me__sessions__revoke.post'],
+  ['DELETE', /^autonomy\/runners\/[^/]+$/, 'autonomy__runners.delete'],
 ];
 
 // A DATE THAT ROTS CANNOT DEMO AN AGE SIGNAL (task 1004041). The help-request

package/src/instance-config.js

@@ -112,17 +112,35 @@ function resolveApiBase({ session, env = process.env, b = safeBrand() } = {}) {
   return fromSession || defaultApiBase(b);
 }
 
+// The folder every config dir lives under: ~/.config, unless BONGOS_CONFIG_ROOT
+// names another one (task 1005095).
+//
+// WHY AN OVERRIDE. An Autobongos runner on a builder's own laptop holds a login
+// of its own (src/bongos/runner-login.js), and it must not share a session file
+// with the builder's CLI: one slot means adding the laptop as a runner signs the
+// builder's own tools out, and removing the runner signs them out again. The
+// runner's device program (scripts/bongos/autobongos-host.js) sets this for the
+// supervisor and every worker it starts, so their session, heartbeat and run log
+// sit apart — and with a root of its own the LEGACY dirs below are not found
+// either, so the runner can never fall back to the builder's own session.
+// One fixed name, read directly: the branded-prefix lookup needs the brand, and
+// this decides where the brand's own dir goes.
+function configRoot(env = process.env) {
+  const over = typeof env.BONGOS_CONFIG_ROOT === 'string' ? env.BONGOS_CONFIG_ROOT.trim() : '';
+  return over ? path.resolve(over) : path.join(os.homedir(), '.config');
+}
+
 // Absolute path to the instance config dir — the WRITE target and first read.
 function configHome(b = safeBrand()) {
-  return path.join(os.homedir(), '.config', configDirName(b));
+  return path.join(configRoot(), configDirName(b));
 }
 
 // All config dirs to try on READ, configured first then legacy, de-duped.
 function configReadDirs(b = safeBrand()) {
-  const home = os.homedir();
+  const root = configRoot();
   const dirs = [configHome(b)];
   for (const d of LEGACY_DIRS) {
-    const p = path.join(home, '.config', d);
+    const p = path.join(root, d);
     if (!dirs.includes(p)) dirs.push(p);
   }
   return dirs;
@@ -367,6 +385,7 @@ module.exports = {
   envPrefix,
   defaultApiBase,
   resolveApiBase,
+  configRoot,
   configHome,
   configReadDirs,
   configPath,

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.76'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.78'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');